1. About this Privacy Policy
This Privacy Policy explains how OnwardCue collects, uses, stores, protects, shares and deletes personal information when you use the OnwardCue website, application and related services (collectively, the Service).
OnwardCue is currently operated by an individual based in the United Arab Emirates (UAE). In this Policy, "OnwardCue," "we," "us," and "our" refer to the operator of the OnwardCue Service.
For privacy questions, requests or concerns, contact:
OnwardCue is intended for users in the UAE and internationally. Depending on where you live, additional privacy rights may apply under local law.
This Policy should be read together with the OnwardCue Terms of Service.
2. Age Requirement
OnwardCue is intended only for people who are 18 years of age or older.
You must not create or use an OnwardCue account if you are under 18.
We do not intentionally offer OnwardCue to children. If we become aware that an account belongs to a person under 18, we may restrict or close the account and take appropriate steps regarding the associated personal information.
If you believe a person under 18 is using OnwardCue, contact privacy@onwardcue.com.
3. Our Privacy Approach
OnwardCue is built around several privacy principles:
Service;
- collect information needed to provide, secure and operate the
created it;
- keep personal habit and progress information scoped to the user who
comparisons;
- do not create public profiles, leaderboards or user-to-user progress
advertising;
- do not sell personal information;
- do not sell or commercially exploit Private Habit Data;
- do not provide Private Habit Data to advertisers for targeted
service purposes; and
- do not use Private Habit Data to build advertising profiles;
- keep Private Habit Data out of routine administrative analytics;
- retain information only for defined operational, security and
- provide deletion processes for reminders and accounts.
These principles do not mean that OnwardCue is end-to-end encrypted or that information can never be accessed by infrastructure systems or authorized personnel when technically necessary to operate, secure, investigate or maintain the Service.
4. Information We Collect
The information we process depends on how you use OnwardCue.
4.1 Account and Profile Information
We may process:
- email address;
- display name;
- optional birth date;
- saved time zone;
- account registration date;
- account status;
- role and feature access;
- authentication method;
- plan or subscription status;
- usage counts;
- last successful sign-in;
- last authenticated activity; and
- account deletion or lifecycle status.
The optional birth date is profile information. OnwardCue does not currently use it to infer your age. The Service is nevertheless restricted to users aged 18 or older.
4.2 Authentication and Security Information
Depending on how you sign in, we may process:
- password hashes;
- email verification information;
- password-reset tokens;
- Google identity identifiers where Google Sign-In is used;
- application session information;
- authentication timestamps;
- security events; and
- limited audit information.
Passwords are not stored in plaintext. OnwardCue currently uses Argon2id password hashing.
4.3 Private Habit Data
For purposes of this Policy, Private Habit Data means the personal information you create through the habit, reminder and self-progress features of OnwardCue.
It may include:
- habit or reminder titles;
- reminder descriptions, where available;
- reminder schedules;
- focus-area names and assignments;
- completion history;
- skipped occurrences;
- progress percentages and check-ins;
- personal notes;
- time invested;
- reminder occurrence/history records;
- personal progress comparisons;
- rhythm and activity information; and
- private milestones.
Some of this information could reveal personal details about your life depending on what you choose to write. You control the content you enter.
4.4 Feedback
If you use the Feedback Hub, we may process:
- feedback category;
- subject;
- message;
- submission date;
- status; and
- related administrative notes.
4.5 Email Delivery and Operational Information
To operate reminder, verification and account emails, we may process limited delivery information such as:
- delivery purpose;
- recipient information or masked recipient;
- provider message identifier;
- request timestamp;
- delivery status;
- bounce or failure status; and
- bounded technical error information.
Long-term delivery records are designed not to retain private habit titles or personal notes.
4.6 Subscription and Payment Information
Where paid features are enabled, OnwardCue may process limited subscription information such as:
- plan;
- subscription state;
- Stripe customer/subscription references;
- billing readiness/status; and
- payment or subscription events required to determine entitlement.
Payment credentials are handled through Stripe-hosted services where configured.
OnwardCue is not intended to store full payment-card numbers or CVV/CVC security codes.
5. How We Use Information
We use personal information as reasonably necessary to:
technical problems;
- create and maintain your account;
- authenticate you and protect your account;
- verify email addresses and support password recovery;
- schedule and manage your reminders;
- send requested reminder and transactional emails;
- record your own progress and history;
- generate your private progress views and comparisons;
- display your calendar, focus areas and milestones;
- maintain your profile and time-zone settings;
- process subscription status where paid functionality is enabled;
- receive and manage feedback;
- provide customer or technical support;
- detect, investigate and prevent abuse, security incidents and
this Policy.
- maintain service reliability and integrity;
- enforce account and service rules;
- comply with applicable legal obligations; and
- operate the retention, recovery and deletion processes described in
We seek to limit processing to purposes connected with providing, protecting and operating OnwardCue.
6. What We Do Not Do With Private Habit Data
OnwardCue does not use Private Habit Data as an advertising product.
We do not:
advertising;
- sell your Private Habit Data;
- sell your personal information;
- display your habits or progress to other OnwardCue users;
- create public habit profiles;
- create public leaderboards;
- rank you against other users;
- provide your Private Habit Data to advertisers for targeted
or
- use your Private Habit Data to build advertising profiles about you;
time entries or personal progress details in routine administrative analytics.
- expose habit titles, notes, focus-area names, completion records,
If OnwardCue's business model or these practices materially change in the future, this Privacy Policy must be updated before the changed practice is introduced where required.
7. Administrative and Operational Access
OnwardCue administrators may access operational account information needed to run the Service, such as:
- account status;
- join date;
- last sign-in;
- last activity;
- role;
- feature access;
- plan;
- pending deletion state; and
- limited delivery-health information.
Routine administrative analytics are intentionally designed not to load Private Habit Data such as habit names, personal notes, completion records, time entries or private focus-area names.
This does not mean that Private Habit Data is technically inaccessible under all circumstances.
Authorized operational or infrastructure access may be necessary in limited situations, for example to:
- investigate a security incident;
- diagnose a serious technical problem;
- maintain or recover infrastructure;
- respond to a valid legal requirement; or
- protect OnwardCue, its users or others from misuse or harm.
Any such access should be limited to what is reasonably necessary for the purpose.
8. Service Providers
OnwardCue relies on service providers to operate parts of the Service.
Current or planned providers include:
Vercel
Used to host and deliver the OnwardCue web application.
Railway
Used for application/API infrastructure, background processing and PostgreSQL/database infrastructure.
Google Identity Services
Used when you choose Google Sign-In. Google processes information under its own terms and privacy practices.
Brevo
Used for transactional email, including account verification, password reset and reminder delivery.
To send an email, the email provider necessarily receives information required to route and process that message.
Stripe
Used, when enabled, for hosted payment, billing and subscription functionality.
Stripe processes payment information under its own terms and privacy practices. OnwardCue receives the information required to understand subscription and entitlement status rather than storing raw card credentials.
We aim to provide service providers only with information reasonably necessary for the service they perform.
Service providers may process information in countries different from your country of residence.
9. When We May Disclose Information
In addition to necessary service-provider processing, we may disclose information where reasonably necessary:
legal process;
- to comply with applicable law, regulation, court order or valid
required; or
- to establish, exercise or defend legal rights;
- to investigate fraud, abuse or security incidents;
- to protect the security and integrity of OnwardCue;
- to protect users or other people where legally permitted or
transfer, subject to applicable privacy requirements.
- as part of a future business reorganization, acquisition or
We do not treat these limited operational or legal disclosures as permission to sell or commercially exploit your Private Habit Data.
10. International Processing
OnwardCue is operated from the UAE and uses technology providers that may process information in other countries.
This means your personal information may be stored or processed outside the country where you live.
Where applicable data-protection law requires safeguards for international transfers, we will seek to use appropriate contractual, organizational or other legally recognized safeguards.
Users in jurisdictions such as the European Economic Area or United Kingdom may have additional protections regarding international transfers.
11. Cookies and Sessions
OnwardCue uses application-session technology necessary to keep users securely signed in and operate authenticated features.
The current application session cookie is designed to be:
- HTTP-only;
- SameSite Lax; and
- Secure outside local development.
HTTP-only means application JavaScript cannot directly read the session token.
OnwardCue may also use technologies that are technically necessary for security, authentication, preferences and reliable operation.
If optional analytics, advertising or other non-essential tracking technologies are introduced later, their use and any consent requirements must be addressed separately. This Policy does not represent that such technologies are currently in use unless they are actually implemented.
12. Sensitive Information --- Please Do Not Store It in OnwardCue
OnwardCue is a habit, reminder and personal-progress service. It is not designed to be a password vault, medical-record system, financial credential store or secure document repository.
Please do not put highly sensitive information into reminder titles, descriptions, focus areas, notes, feedback or other free-text fields.
Examples include:
harm.
- passwords;
- PINs;
- security-question answers;
- authentication secrets;
- API keys or cryptographic keys;
- bank-account credentials;
- payment-card details;
- passport numbers;
- Emirates ID numbers;
- national identification numbers;
- driver-licence numbers;
- detailed medical records or diagnoses;
- prescriptions;
- detailed therapy or mental-health records;
- highly intimate or sexual information;
- confidential employer or client information;
- sensitive information belonging to another person; or
- information whose loss or disclosure could reasonably cause serious
Keep it personal, but not highly sensitive.
If you choose to enter sensitive information despite this warning, OnwardCue cannot guarantee that the information will never be lost, corrupted, accessed without authorization or become unavailable.
13. Reminder Deletion and Recovery
When you intentionally delete a reminder or habit:
and private history are permanently purged from the active system.
- it is removed from normal application views;
- it remains recoverable through Deleted Items for 15 days;
- you may restore it during that recovery period; and
- after the recovery period expires, its associated Private Habit Data
OnwardCue may retain a privacy-safe deletion event or aggregate count for operational/product analytics, but this record is designed not to retain the deleted habit content, user email or other Private Habit Data.
Deleted information may remain temporarily in protected backups as described below.
14. Account Deletion
You can request deletion of your OnwardCue account.
Account deletion is separate from cancelling a paid subscription.
The account-deletion process includes:
period.
- re-authentication;
- explicit confirmation;
- a 14-day cooling-off period; and
- an explicit option to cancel the deletion request during that
Simply signing in during the cooling-off period does not automatically cancel your deletion request. You must intentionally select the cancellation action.
If you do not cancel before the scheduled deletion date, OnwardCue performs final account deletion.
At final deletion, Private Habit Data and profile information are removed from the active Service, including, where applicable:
- habits and reminders;
- descriptions;
- focus areas;
- personal notes;
- completion and skip history;
- progress/check-ins;
- time-invested history;
- personal milestones/comparisons;
- display name;
- optional birth date;
- time-zone/profile information;
- authentication identities/tokens; and
- active sessions.
Feedback may be retained as described in the Feedback section below.
Some limited operational/security information may remain temporarily according to the retention schedule.
15. Inactive Free Accounts
A Free account follows the following inactivity lifecycle:
may be marked inactive;
- after 6 months without authenticated user activity, the account
account-deletion warning;
- at approximately 11 months of inactivity, OnwardCue sends an
sends a final warning; and
- approximately 7 days before the final deletion date, OnwardCue
scheduled for permanent deletion.
- at 12 months without authenticated user activity, the account is
Authenticated user activity before permanent deletion reactivates the account and cancels the inactivity-based deletion schedule.
Automated reminder processing, background jobs, delivery webhooks and administrative activity do not count as your authenticated activity for this purpose.
16. Paid Subscription Cancellation, Expiry and Payment Failure
Payment status does not control whether your Private Habit Data is deleted.
If a paid/Plus subscription:
- is cancelled;
- expires;
- is downgraded; or
- ends after a failed-payment grace period,
the OnwardCue account is treated as a Free account.
The payment event itself does not delete your habits, reminders, notes, progress or other Private Habit Data.
The account then follows the ordinary Free-account lifecycle.
If you want your account and Private Habit Data deleted, you must use the account-deletion process described above, or the data may eventually be removed through the normal Free-account inactivity lifecycle.
Payment failure currently has a 14-day grace period before Plus entitlement expires to Free.
17. Retention Schedule
OnwardCue's current application retention rules are:
[[RETENTION_TABLE]] ----------------------------------- Active account information While needed to provide and operate the active account
Deleted reminder/habit Recoverable for 15 days, then Private Habit Data is purged
Explicit account deletion 14-day cooling-off period before final deletion
Inactive Free account Inactive at 6 months; warnings before deletion; purge at 12 months
Residual deleted-account No more than 180 days after final email/minimal activity metadata deletion
Email-delivery operational records 180 days
Ended local Stripe references Normally 60 days
Security/admin audit logs Maximum 1 year and designed not to contain Private Habit Data
Feedback May remain after account identity is removed, subject to anonymization/redaction
Normal backups Target 30-day retention
Deleted information in protected Maximum target of 90 days, subject backup lifecycle to infrastructure/provider configuration -----------------------------------------------------------------------
Retention may be extended where information must lawfully be preserved for a legal claim, regulatory requirement, security investigation or other legal obligation. Where that occurs, processing should be limited to the applicable purpose.
18. Backups
OnwardCue uses or may use protected database/infrastructure backups for disaster and system recovery.
The current target is:
protected backups.
- normal backup retention of 30 days; and
- a maximum 90-day lifecycle for deleted information remaining in
Backup lifecycle ultimately depends on the capabilities and configuration of the infrastructure provider.
Deleting information from the active production database does not necessarily remove every historical backup copy immediately.
Backups are intended for disaster/system recovery and are not intended to be used to selectively restore an individually deleted account back into normal production.
If a backup containing previously deleted information must be restored after a disaster, OnwardCue should reapply applicable deletion records/processes where technically possible.
19. Feedback Retention
Feedback can remain useful to OnwardCue after the submitting account has been deleted.
When an account reaches final deletion, OnwardCue is designed to disassociate retained feedback from that account.
We may retain:
- feedback category;
- subject;
- message;
- date;
- status; and
- product/admin notes.
We remove the ordinary account association and direct account identity.
Because users can type free-form feedback, the message itself could contain identifying or private information. Where appropriate, identifying/private message content may need to be manually redacted.
Do not use the Feedback Hub to submit highly sensitive information.
20. Security
OnwardCue uses technical and organizational measures intended to protect personal information.
Current measures include, where applicable:
analytics.
- authenticated access to protected application functions;
- server-side ownership and role authorization;
- Argon2id password hashing;
- HTTP-only application sessions;
- secure cookies outside local development;
- environment-based protection of provider credentials;
- verified provider webhooks;
- separation of staging and production environments;
- bounded background processing;
- idempotency protections;
- administrative access restrictions; and
- privacy boundaries that keep Private Habit Data out of routine admin
No internet service, database or security system is perfect.
OnwardCue cannot guarantee that information will never be lost, corrupted, accessed without authorization, disclosed because of an unforeseen security incident or temporarily unavailable.
You should not use OnwardCue as the sole repository for important or highly sensitive information.
21. Data Breaches and Security Incidents
If OnwardCue becomes aware of a personal-data security incident, we will investigate and take reasonable steps appropriate to the nature and risk of the incident.
Where applicable law requires notification to affected users or a regulator, we will seek to provide that notification in accordance with those requirements.
22. Your Privacy Rights
Depending on where you live and which privacy law applies, you may have rights relating to your personal information.
These may include the right to:
privacy/data-protection authority.
- ask what personal information we hold about you;
- request access to personal information;
- request correction of inaccurate or outdated information;
- request deletion where applicable;
- request restriction or cessation of certain processing;
- object to certain processing where applicable;
- withdraw consent where processing depends on consent;
- request portability or a copy of information where applicable; and
- raise a complaint or concern with an appropriate
These rights are not absolute. Applicable law may permit or require us to retain or continue processing certain information.
To make a privacy request, contact:
We may need to verify your identity before fulfilling a request so that we do not disclose or delete another person's information.
Where the application provides an account-deletion or correction feature directly, you may use that feature instead.
23. UAE Privacy Framework
OnwardCue is operated from the United Arab Emirates.
The UAE's Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data establishes a federal framework concerning personal-data processing, security/confidentiality, individual rights and cross-border processing.
OnwardCue intends to handle personal information consistently with applicable UAE requirements.
Depending on a user's location and how OnwardCue offers the Service there, other privacy laws may also apply.
24. Users in the European Economic Area
If EU data-protection law applies to our processing, additional rights and requirements may apply under the General Data Protection Regulation (GDPR).
Depending on the processing activity, processing may be based on grounds such as:
Service where those interests are not overridden by your rights;
- performance of the service requested by you;
- legitimate interests in securing, maintaining and improving the
- compliance with legal obligations; or
- consent where consent is legally required.
If GDPR applies, you may also have rights such as access, rectification, erasure, restriction, objection and portability, subject to the conditions and exceptions in applicable law.
OnwardCue is operated outside the European Economic Area, so use of the Service may involve international processing.
25. Users in the United Kingdom
If UK data-protection law applies to our processing, you may have rights under the UK GDPR and related UK data-protection legislation.
OnwardCue is operated outside the United Kingdom, and use of the Service may therefore involve international processing.
Contact privacy@onwardcue.com for privacy requests relating to your OnwardCue information.
26. Automated Decision-Making
OnwardCue calculates personal progress, comparisons, milestones and related self-progress information from your own activity.
These features are designed to help you understand your own history and are not intended to make legal, employment, financial, medical, insurance or similarly significant decisions about you.
OnwardCue does not rank you against other users.
27. No Advertising Profile From Your Habits
OnwardCue does not currently use your Private Habit Data to create advertising profiles or enable advertisers to target you based on your habits, notes, focus areas, progress or time invested.
If OnwardCue introduces advertising or materially different analytics in the future, the privacy implications must be reviewed and this Policy updated before those practices are represented as covered by this version.
28. Changes to This Privacy Policy
OnwardCue may update this Privacy Policy as the Service, providers, legal requirements or privacy practices change.
When we make changes, we will update the Last updated date.
For material changes, we may provide additional notice through the Service, by email or by another appropriate method.
Where applicable law requires renewed consent or another specific action, we will seek to obtain it.
Historical policy versions and acceptance records may be retained where reasonably necessary to demonstrate which terms/privacy notice applied to an account.
29. Contact Us
For privacy questions, data requests, account-data concerns or complaints:
Email: privacy@onwardcue.com\ Service: OnwardCue\ Operator location: United Arab Emirates
Please do not send passwords, payment-card information, identification documents or other highly sensitive information by ordinary email unless specifically requested through an appropriate secure process.
------------------------------------------------------------------------
Appendix A --- Plain-Language Privacy Summary
This summary is provided for convenience. The full Privacy Policy above controls where more detail is required.
Your progress is yours
Your habits, reminders, notes, focus areas and progress are part of your private OnwardCue experience.
We don't sell your habit data
We do not sell your Private Habit Data or use it to build advertising profiles.
Other users cannot see your habits
OnwardCue is not a social network. There are no public profiles, public leaderboards or user-to-user progress rankings.
Routine admins don't browse your habits
Routine administrative analytics are designed not to load your habit titles, notes, focus-area names, completion history or time entries.
Some providers are necessary
Hosting, authentication, email and payment providers process information needed to perform those services.
You can delete
Deleted reminders have a 15-day recovery period. Account deletion has a 14-day cooling-off period before final deletion.
Payment cancellation does not delete your progress
A cancelled, expired or failed paid subscription becomes a Free account. Payment status alone does not delete your habits.
Inactive Free accounts don't remain forever
Free accounts become inactive after 6 months without authenticated activity and may be deleted after 12 months, with warnings beforehand.
Don't store secrets here
Do not use OnwardCue for passwords, banking credentials, identification numbers, detailed medical records or other highly sensitive information.
Questions?
Contact privacy@onwardcue.com.
------------------------------------------------------------------------
Appendix B --- Reference Framework and Provider Information
These links are provided as supporting information and are not incorporated as contractual terms of this Privacy Policy.
https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
- UAE Government --- Data protection laws:
Protection of Personal Data: https://uaelegislation.gov.ae/en/legislations/1972
- UAE Legislation --- Federal Decree-Law No. 45 of 2021 Concerning the
https://eur-lex.europa.eu/eli/reg/2016/679/oj
- EU GDPR --- Regulation (EU) 2016/679:
- UK Information Commissioner's Office --- UK GDPR guidance:
- Google Privacy Policy: https://policies.google.com/privacy
- Brevo privacy/GDPR information:
- Stripe Privacy Center: https://stripe.com/legal/privacy-center
------------------------------------------------------------------------